meta-balir-syvon[.]pages[.]dev

The domain meta-balir-syvon.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are lynn.ns.cloudflare.com and margaret.ns.cloudflare.com. DNS resolution points to IP address 172.66.45.18, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and serves a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the malicious intent. Reputation services assign extremely low trust scores: Gridinsoft reports 0/100 and Scamadviser reports 1/100, both indicating a high likelihood of abuse.

On VirusTotal, 16 of 93 scanning engines flagged the domain as malicious, confirming its classification as a credential phishing site. The host is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. HTTP responses return a 403 status, and the site employs security technologies such as HSTS and HTTP/3 through Cloudflare, which may be used to obscure malicious traffic. The current operational status is offline, and the risk level is elevated.

Defenders should immediately add the domain and its associated IP address to deny‑list rules across firewalls, proxy devices, and endpoint protection platforms. Monitoring for any re‑registration or similar sub‑domains under the pages.dev namespace is advised, as the use of Cloudflare's free hosting infrastructure facilitates rapid redeployment. Additionally, security teams should update threat intelligence feeds with the observed trust scores, blocklist entries, and VirusTotal detection metadata to improve detection of related campaigns.